Vulnerability · Published Jul 20, 2025 · Assigned by VulDB

CVE-2025-7875Metasoft 美特软件 MetaCRM debug.jsp improper authentication

High 7.3

In plain English

A high-severity improper authentication in MetaCRM from Metasoft 美特软件. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.8%top 44.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as critical has been found in Metasoft 美特软件 MetaCRM up to 6.4.2. This affects an unknown part of the file /debug.jsp. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Metasoft 美特软件	MetaCRM	6.4.06.4.16.4.2

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-316989 | Metasoft 美特软件 MetaCRM debug.jsp improper authentication vdb-entry
VDB-316989 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
https://github.com/FightingLzn9/vul/blob/main/MetaCRM6-SIL-2.md exploit